Loading story…
Rsync 3.5.0 has been released with fixes for 33 vulnerabilities affecting the widely used file synchronization utility, including several critical and high-severity issues in the rsync daemon, file handling, path validation, logging, proxy protocol support, and the restricted rrsync wrapper. The most serious flaws include client IP spoofing when proxy protocol = true is enabled, command-execution risks tied to RSYNC_CONNECT_PROG and rsync-ssl, arbitrary file overwrite conditions involving symlink and path-handling weaknesses, and bypasses that undermine rrsync restrictions.
The update also addresses information disclosure, denial-of-service conditions, access-control weaknesses, and file-handling risks that can arise in privileged or chroot-adjacent deployments. Reported mitigations include restricting which hosts may use proxy protocol, avoiding unsafe privileged usage patterns, tightening file-opening behavior with protections such as O_NOFOLLOW, and reviewing DNS-dependent controls such as hosts deny logic that may be bypassed under some conditions.
See real exploitation activity before you spend the cycle.
2 events from the most recent confirmed update back to the earliest known activity.
Backport patch sets for rsync versions 3.2.7 and 3.4.1 were sent to distro maintainers via distros@vs.openwall.org the week before the 3.5.0 announcement. The project also published GitHub security patch branches for both older versions to support downstream updates.
A new Rsync 3.5.0 release was published, addressing 33 security vulnerabilities across daemon behavior, proxy protocol handling, file and path processing, logging, access controls, and the restricted rrsync wrapper. The reported issues include critical, high, and medium-severity flaws, with mitigations such as restricting proxy protocol hosts and using safer file-opening practices like O_NOFOLLOW.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
10 references tracked. Mallory keeps watching after this page renders.
acn.gov.it
Open sourceseclists.org
Open sourceopennet.me
Open sourceopennet.ru
Open sourcevulncheck.com
Open sourcersync.samba.org
Open sourcemail-archive.com
Open sourcedownload.samba.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
dCERT issued two advisories for **Rsync** covering separate vulnerabilities that could expose organizations using the file synchronization tool to attack. One advisory describes an **unspecified attack** path in Rsync, indicating a flaw that could be exploited without public technical detail in the notice, while a second advisory warns that another vulnerability could allow attackers to **bypass security measures**. The paired notices indicate multiple security issues affecting Rsync and raise concern for environments that rely on it for file transfer, backup, or synchronization workflows. Although the advisories provide limited public detail, the combination of an attack-enabling flaw and a security-control bypass suggests defenders should review affected Rsync deployments, monitor for vendor guidance, and prioritize remediation once patches or mitigation steps are confirmed.
Jun 29, 2026
Authorities warned of critical vulnerabilities in two widely used backup and file synchronization products, with the most severe issues enabling remote code execution. In **Veeam Backup & Replication** version `12.3.1.1139` and all earlier `12.x` releases, **CVE-2025-23121** can allow code execution on a backup server when an authenticated domain user account is available, particularly on domain-joined systems. Two additional Veeam flaws, **CVE-2025-24286** and **CVE-2025-24287**, can also lead to arbitrary code execution through backup job modification by an authenticated backup operator or by manipulating local directory contents as a local system user. A separate alert covered **Rsync** version `3.3.0` and earlier, where six server-side vulnerabilities were disclosed. The most critical, **CVE-2024-12084**, can allow arbitrary code execution on a target Rsync server, while additional flaws include **CVE-2024-12085**, **CVE-2024-12747**, **CVE-2024-12086**, **CVE-2024-12087**, and **CVE-2024-12088**; the client application is not affected. Defenders were urged to apply vendor fixes immediately, including upgrading Veeam to version `12.3.2` build `12.3.2.3617` and installing patched Rsync packages provided by Linux distributors.
Jun 29, 2026
A vulnerability tracked as **CVE-2026-29518** affects the `rsync` daemon and has been described as a symlink-race **time-of-check time-of-use (TOCTOU)** flaw. The issue is tied to daemon deployments configured with `use chroot = no`, a setting that removes the additional filesystem isolation normally provided by `chroot` and can increase exposure to path-handling attacks involving symbolic links. The flaw has been documented by multiple downstream vendors and trackers, including SUSE and Debian, and is reflected in upstream `rsync` release notes. Organizations running `rsync` in daemon mode should review whether `use chroot = no` is enabled, prioritize vendor patches for affected packages, and assess any services that expose `rsync` modules to untrusted clients or writable content paths.
Jun 29, 2026